SMTP to the Internet

This rule detects events that may describe SMTP traffic from internal hosts to a host across the Internet. In an enterprise network, there is typically a dedicated internal host that performs this function. It is also frequently abused by threat actors for command and control, or data exfiltration.

Rule type: query
Rule indices:

• filebeat-*
• packetbeat-*
• logs-endpoint.events.*

Rule Severity: low
Risk Score: 21
Runs every:
Searches indices from: now-9m
Maximum alerts per execution: 100
References:

Tags:

• Elastic
• Host
• Network
• Threat Detection
• Command and Control

Version: 100
Rule authors:

• Elastic

Rule license: Elastic License v2

event.category:(network or network_traffic) and network.transport:tcp and (destination.port:(25 or 465 or 587) or event.dataset:zeek.smtp) and
  source.ip:(
    10.0.0.0/8 or
    172.16.0.0/12 or
    192.168.0.0/16
  ) and
  not destination.ip:(
    10.0.0.0/8 or
    127.0.0.0/8 or
    169.254.0.0/16 or
    172.16.0.0/12 or
    192.168.0.0/16 or
    224.0.0.0/4 or
    "::1" or
    "FE80::/10" or
    "FF00::/8"
  )
		

Framework: MITRE ATT&CK

• Tactic:
  • Name: Command and Control
  • Id: TA0011
  • Reference URL: https://attack.mitre.org/tactics/TA0011/

Framework: MITRE ATT&CK

• Tactic:

  • Name: Exfiltration
  • Id: TA0010
  • Reference URL: https://attack.mitre.org/tactics/TA0010/

• Technique:

  • Name: Exfiltration Over Alternative Protocol
  • Id: T1048
  • Reference URL: https://attack.mitre.org/techniques/T1048/